0123418ffeceaec339159113651a7f2bb502b64b25a34d812b27ff88e1e53db3

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:18

Target

明月11.79/wsbox.dll
Size

630KB
MD5

3c2454abce90428bc45749cdd266d3b4
SHA1

b1506fc7eb75e427655f2dd9d92c3d7a8e9d3de0
SHA256

354dd101eb1d3f7a8c2eb68b357bb9dd67936c8f23170af6b580ef0e18c43f64
SHA512

679786b8f2da3c06b1f62a06c12fc2fb8b57302dc1ce6d3e5c3cedc554450e3d21cc625a4d92128627d12973437ed7dc1ffaf610cf40e6cbffe85ddbd1cfc041
SSDEEP

12288:u3NBMO1GG2hNyCrlXhxFIbUr1jnnjomY9Pp/8W:u3bM74CrlXhYQrtns3ZV8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1404 wrote to memory of 1400	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1400	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1400	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1400	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1400	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1400	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1400	1404	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\wsbox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\wsbox.dll,#1
  2⤵
  PID:1400

memory/1400-54-0x0000000000000000-mapping.dmp

Download
memory/1400-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1400-56-0x00000000745A0000-0x0000000074798000-memory.dmp

Filesize
2.0MB

Download
memory/1400-58-0x00000000745A0000-0x0000000074798000-memory.dmp

Filesize
2.0MB

Download
memory/1400-59-0x00000000743A0000-0x0000000074598000-memory.dmp

Filesize
2.0MB

Download
memory/1400-60-0x00000000745A0000-0x0000000074798000-memory.dmp

Filesize
2.0MB

Download